VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Dec 9, 2020· Updated Jun 17, 2026

CVE-2020-26838

CVE-2020-26838

Description

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it.

Affected products

18
  • SAP/Business Warehouse12 versions
    cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*
  • SAP/Bw\/4hana3 versions
    cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:*
    • (no CPE)range: 100, 200
  • SAP/SAP Business Warehousellm-fuzzy
    Range: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782
  • SAP SE/SAP Business Warehousev5
    Range: < 700
  • SAP SE/SAP BW4HANAv5
    Range: < 100

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.